Engineer Bot — Learning #2
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Engineer Bot — learning (retrospective) extraction — DAILY CRON. | |
| # | |
| # Over an adaptive look-back window the engine gathers merged PRs (diff + review | |
| # comments) AND recent engineer-bot author-run console logs ITSELF via the GitHub | |
| # API — no in-workflow context gathering, no per-PR trigger — and if the model | |
| # finds durable, reusable learnings, opens ONE ROLLING PR on a stable branch | |
| # (`ai/learning-pr`), appending a dated section per day until a human merges it. | |
| # Human-gated by design: it NEVER commits the canonical log directly. | |
| # | |
| # Own job (NOT `uses: databricks/databricks-bot-engine/...`): an external repo | |
| # can't resolve the internal engine's reusable workflows ("not found"). It shares | |
| # the SAME prelude the other bots use — ./.github/actions/bot-prelude (tokens + | |
| # Node + pinned engine install) — so the engine pin stays single-sourced in | |
| # bot-prelude's `engine-ref` default (no second SHA to drift). | |
| # | |
| # Opt-in is purely via the `retrospective:` block in .bot/config.yaml + this | |
| # workflow; absent that block the engine phase is a clean no-op. | |
| name: Engineer Bot — Learning | |
| on: | |
| schedule: | |
| # 17:23 UTC daily — off-peak, off-:00 minute (GitHub delays/drops on-the-hour crons). | |
| - cron: "23 17 * * *" | |
| workflow_dispatch: | |
| inputs: | |
| since: | |
| description: 'ISO lower bound to shorten the window and recover a wedged flow. Empty = adaptive cursor.' | |
| type: string | |
| default: '' | |
| window-hours: | |
| # STRING, not number: a `type: number` workflow_dispatch input fails the | |
| # whole run at startup ("workflow file issue") when combined with the | |
| # `schedule` trigger. argparse coerces it to int downstream. | |
| description: 'Fallback look-back window (hours) used only when there is no prior successful run.' | |
| type: string | |
| default: '24' | |
| permissions: | |
| contents: write # push the learning branch / open the learning PR | |
| pull-requests: write | |
| actions: read # Track B lists engineer-bot author runs + logs via the App token; | |
| # the engineer-bot App installation must ALSO carry actions:read | |
| # (a missing scope surfaces as a 403 that fails the whole run — | |
| # list_author_runs raises, no escape hatch). | |
| id-token: write # JFrog OIDC exchange for the engine/SDK/CLI install | |
| concurrency: | |
| # One learning run at a time; a queued run waits rather than racing the rolling | |
| # PR's branch. Not keyed on a PR number (this is a cron, no PR event). | |
| group: engineer-bot-learning-cron | |
| cancel-in-progress: false | |
| jobs: | |
| learning: | |
| environment: azure-prod # DATABRICKS_HOST / DATABRICKS_TOKEN live here | |
| runs-on: | |
| group: databricks-protected-runner-group | |
| labels: [linux-ubuntu-latest] | |
| timeout-minutes: 20 | |
| steps: | |
| # Checkout the default branch (the learning PR is cut from it) FIRST, so the | |
| # local `./` composites below resolve. persist-credentials:false — the | |
| # retrospective sets its own authenticated push remote (see the run step), | |
| # so no token is left in .git/config. | |
| - name: Checkout default branch (learning PR is cut from it) | |
| uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| # No JFrog setup step here: install-bot-engine (via bot-prelude) does its own | |
| # keyless OIDC→JFrog mint and passes the credential through job-local files + | |
| # per-command --index-url flags. It deliberately never reads PIP_INDEX_URL / | |
| # JFROG_ACCESS_TOKEN from the environment, so a setup-jfrog step would be both | |
| # redundant AND a credential leak (setup-jfrog exports a token-bearing | |
| # PIP_INDEX_URL to $GITHUB_ENV, exposing it to every later step — including the | |
| # one that runs the model). Mirrors the read-only sibling reviewer-bot.yml. | |
| - name: Setup Python | |
| uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0 | |
| with: | |
| python-version: '3.11' | |
| # Shared prelude: mint the engineer-bot token (opens the learning PR) + the | |
| # engine-scoped token, set up Node, install the pinned engine (PAT-free). The | |
| # engine pin comes from bot-prelude's `engine-ref` default — the SINGLE source | |
| # of truth for every bot; there is no second SHA in this file to drift. | |
| - name: Bot prelude (tokens + Node + engine install) | |
| id: prelude | |
| uses: ./.github/actions/bot-prelude | |
| with: | |
| app-id: ${{ secrets.ENGINEER_BOT_APP_ID }} | |
| private-key: ${{ secrets.ENGINEER_BOT_APP_PRIVATE_KEY }} | |
| # NOTE: no git-identity step — the engine's retrospective configures the git | |
| # user AND DCO sign-off itself from .bot/config.yaml `bot_login_prefix`. | |
| # NOTE: no context-gather step — the daily-cron engine enumerates merged PRs | |
| # + author runs itself over the adaptive window. | |
| - name: Extract learnings + open rolling PR | |
| env: | |
| GH_TOKEN: ${{ steps.prelude.outputs.token }} | |
| GITHUB_REPOSITORY: ${{ github.repository }} | |
| # Only the `<workspace>/serving-endpoints/` prefix matters: | |
| # sdk_agent.translate_endpoint rewrites this to `.../serving-endpoints/anthropic` | |
| # and discards the model path segment. The effective model comes from | |
| # .bot/config.yaml `retrospective.model` (or the engine default). | |
| MODEL_ENDPOINT: https://${{ secrets.DATABRICKS_HOST }}/serving-endpoints/anthropic/invocations | |
| DATABRICKS_TOKEN: ${{ secrets.DATABRICKS_TOKEN }} | |
| RUNNER_TEMP: ${{ runner.temp }} | |
| SINCE: ${{ inputs.since }} | |
| WINDOW_HOURS: ${{ inputs.window-hours }} | |
| # The retrospective pushes the learning branch with a plain `git push | |
| # origin`, and the checkout ran persist-credentials:false — so set an | |
| # authenticated push remote from the minted App token first, mirroring | |
| # engineer-bot.yml's publish step. --since / --window-hours are passed only | |
| # when provided via workflow_dispatch (the schedule trigger leaves them | |
| # empty → the adaptive cursor drives the window). | |
| run: | | |
| git remote set-url origin "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git" | |
| args=(--repo-dir "$GITHUB_WORKSPACE") | |
| [ -n "$SINCE" ] && args+=(--since "$SINCE") | |
| [ -n "$WINDOW_HOURS" ] && args+=(--window-hours "$WINDOW_HOURS") | |
| python -m databricks_bot_engine.engineer_bot.retrospective "${args[@]}" |